The Compliance Framework That Doesn't Exist

Open your LinkedIn feed on any given Tuesday and count the companies promising "instant bank accounts," "no-KYC debit cards," and "frictionless onboarding for the underbanked." Scroll a bit further and you will find the RWA tokenization crowd announcing that they have "put a building on the blockchain" or "tokenized a Picasso" with approximately zero discussion of custody law, securities regulation, or what happens when a borrower defaults against a fractional NFT representing 0.003% of a warehouse in Topeka.

Every one of them is a compliance liability wearing a product-market fit costume.

The pattern is familiar because we have watched it play out three times in a decade. The 2021-2022 crypto lending cycle produced BlockFi, Celsius, Voyager, and Genesis -- companies that collectively vaporized north of $30 billion in customer assets. Their failure mode was identical every time: they built lending products without building compliance infrastructure. They grew faster than their risk management. They confused regulatory arbitrage with regulatory strategy. They are gone now, and the customers they harmed are still in bankruptcy proceedings.

The survivors learned nothing. The new crop of "alternative asset" companies is making the same architectural mistake with better branding.

Missing Infrastructure at the Regulatory Layer

Ask any company selling "RWA infrastructure" or "digital asset custody solutions" what compliance framework governs pledged-asset lending against alternative collateral. The answer is silence, because the framework does not exist.

Not SOC 2. SOC 2 covers information security controls -- access management, encryption, incident response. Valuable, necessary, and entirely silent on how to value a startup equity position, perfect a security interest in cryptocurrency, or generate adverse action notices when a borrower's LP interest declines below the maintenance threshold.

Not ISO 27001. Same domain, same limitations.

Not PCI DSS. Not NIST CSF. Not COBIT. Not any of the frameworks that compliance teams at regulated financial institutions use to demonstrate examination readiness.

When a credit union's board asks "what controls do we need before we can lend against our members' crypto holdings," the compliance officer has no framework to reference. No control catalog to adopt. No examination preparation guide. No evidence automation. Nothing.

That officer is left to improvise, stitching together fragments of OCC Bulletin 2011-12 model risk guidance, FFIEC examination procedures, NCUA vendor management requirements, UCC Article 8 and 9 custody provisions, GLBA data protection standards, and whatever state-specific digital asset regulations apply -- then hoping the examiner agrees with their interpretation.

This is not a theoretical problem. It is a deployment blocker. Institutions that want to offer pledged-asset lending cannot demonstrate compliance readiness because the compliance framework does not exist.

Alice's Compliance Problem

Alice runs compliance at a $2 billion credit union. Her institution's members hold significant positions in cryptocurrency, private equity funds, restricted stock, and REIT shares. These members currently go to Schwab or Goldman for securities-backed lines of credit because the credit union cannot lend against assets it cannot see, value, or perfect a security interest against.

Alice's CEO wants to change this. The board approved a pledged-asset lending initiative. Alice now needs to answer four questions before a single loan can originate:

First, what controls govern how the institution discovers and verifies member assets across custodians, wallets, and transfer agents? No existing framework addresses multi-custodial asset aggregation for lending purposes.

Second, what controls govern real-time valuation of volatile alternative assets for collateral adequacy? OCC 2011-12 provides model risk management principles, but it does not specify controls for continuous collateral monitoring across asset classes with fundamentally different volatility profiles.

Third, what controls govern perfection of security interests in digital assets, tokenized securities, and other non-traditional collateral? UCC Article 12 adoption is progressing state by state, but no framework maps the control requirements for institutions operating across jurisdictions with different perfection standards.

Fourth, what evidence does Alice need to produce during examination to demonstrate that the institution's pledged-asset lending program satisfies NCUA, CFPB, and state regulatory requirements?

Alice cannot answer these questions by referencing SOC 2 or ISO 27001. She needs a purpose-built compliance framework for pledged-asset lending, and until now, that framework has not existed.

ACAF: What We Built

The Aaim Compliance Assurance Framework is a 152-control compliance framework organized into eight domains, purpose-built for financial institutions deploying pledged-asset lending against alternative collateral. It is designed to install as a custom framework within Drata's compliance automation platform, where cross-mapping to existing frameworks means institutions already maintaining SOC 2 compliance receive approximately 35-40% overlap credit on day one.

The eight domains:

PAL-1: Third-Party Risk Management. 18 controls governing vendor oversight, technology provider due diligence, and ongoing monitoring for all parties to a pledged-asset lending program. Maps to FFIEC third-party risk management guidance and NCUA Supervisory Letter 07-01.

PAL-2: Valuation Governance. 22 controls covering model methodology documentation, validation protocols, performance monitoring, back-testing requirements, and accuracy thresholds. The densest domain because valuation is the core risk in alternative asset lending. Maps to OCC 2011-12, Federal Reserve SR 11-7, and FIRREA appraisal standards where applicable.

PAL-3: Perfection and Custody. 21 controls addressing security interest perfection across asset types, control agreement structures, custodian integration requirements, and UCC filing procedures. This domain accounts for jurisdictional variation in UCC Article 8, 9, and 12 adoption.

PAL-4: Digital Asset Operations. 22 controls specific to cryptocurrency and tokenized asset custody, wallet management, blockchain monitoring, and smart contract risk. Addresses CFTC guidance on digital asset collateral acceptance and state-level digital asset custody requirements.

PAL-5: Data Privacy and Protection. 20 controls covering member data handling across the lending lifecycle, GLBA Safeguards Rule compliance, state privacy law requirements, and data minimization principles specific to financial asset information.

PAL-6: Model Risk Management. 19 controls implementing OCC 2011-12 and SR 11-7 requirements specific to AI/ML models used in asset valuation, risk scoring, and collateral monitoring. Includes explainability requirements satisfying ECOA adverse action notice standards as reinforced by CFPB Circular 2022-03.

PAL-7: BSA/AML Compliance. 17 controls addressing anti-money laundering obligations specific to pledged-asset transactions, including beneficial ownership verification across complex asset structures, source-of-funds documentation for alternative assets, and suspicious activity monitoring patterns unique to collateral-backed lending.

PAL-8: Examination Readiness. 13 controls governing documentation standards, examiner access protocols, evidence retention, and pre-examination preparation procedures. This domain exists because the best controls in the world are worthless if the institution cannot demonstrate their operation during examination.

Of these 152 controls, 90 are net-new -- they do not exist in any current compliance framework. The remaining 62 cross-map to existing frameworks, giving institutions credit for controls they already maintain.

Why This Matters for the Industry

The RWA tokenization companies are building interesting technology. Some of them may even produce useful products. But they share a structural deficiency with the crypto lenders that preceded them: they are building products without building the compliance infrastructure those products require to operate within regulated institutions.

A credit union cannot adopt an RWA platform and then improvise the compliance program. Examiners will arrive with questions, and the institution needs documented controls, evidence of operation, and a framework that maps to established regulatory standards.

The "no-KYC" crowd is worse. They are not building compliance infrastructure because compliance is antithetical to their value proposition. Their customers are not regulated institutions. Their customers are people who want to move money without oversight, and when those companies fail or get shut down -- and they will -- the regulatory backlash will make it harder for legitimate infrastructure providers to serve the institutions that need this technology.

Every unregistered money transmitter running a "fintech" marketing campaign, every "DeFi lending protocol" that is actually a securities offering without registration, every "instant banking" product that skips KYC because compliance costs money -- these companies impose negative externalities on the entire sector. They confirm the regulator's prior that digital asset innovation is synonymous with consumer harm, and that prior makes it harder for institutions like Alice's credit union to serve their members.

Every examination that catches an institution unprepared because it improvised its compliance program is another data point confirming that prior.

The Examiner Is Coming

NCUA's 2025-2026 examination priorities explicitly include third-party technology risk, digital asset exposure, and AI model governance. State banking departments are coordinating examination approaches for alternative asset lending. The CFTC's digital asset pilot program under Acting Chairman Pham's guidance requires eligible asset determination, legal enforceability of security interests, custody verification, and valuation methodology -- four requirements that map directly to ACAF domains PAL-2, PAL-3, PAL-4, and PAL-8.

FHFA's July 2025 directive ordering Fannie Mae and Freddie Mac to develop proposals for accepting cryptocurrency as mortgage collateral signals that alternative asset consideration is moving from fringe to mainstream. When GSEs accept crypto collateral, examination standards will follow, and every institution participating will need a compliance framework that addresses the unique risks.

The institutions that deploy pledged-asset lending with a purpose-built compliance framework will face examination with confidence. The institutions that deploy without one will face examination with anxiety, legal fees, and potential enforcement action.

The Standard That Becomes The Standard

A compliance framework achieves dominance not through mandate but through adoption. When enough institutions use the same framework, examiners develop familiarity. When examiners develop familiarity, examination friction decreases. When examination friction decreases, adoption accelerates. The first framework to achieve critical mass in a new domain becomes the de facto standard, and the cost of competing against an established standard is prohibitive.

ACAF is designed to be that standard for pledged-asset lending. Not because we declared it so, but because no alternative exists and the institutions deploying this technology need it now, not in three years when a standards body convenes a working group.

We built it because the math was obvious. Younger investors allocate 31% of their portfolios to alternative assets, according to Bank of America research. The $124 trillion generational wealth transfer documented by Cerulli Associates will shift trillions into asset classes that regulated institutions currently cannot lend against. Those institutions need compliance infrastructure before they need lending technology, and we are in a position to provide both.

What Comes Next

ACAF is currently in structured design, with framework documentation, control specifications, and cross-mapping tables in development. The Drata ISV partnership will provide the platform infrastructure for deployment, evidence automation, and continuous monitoring. Aaim's platform integration connector will feed telemetry directly into customer Drata workspaces, automating evidence collection for approximately 60% of ACAF controls.

The pilot deployment targets the CU WealthNext credit union network, where institutions are already evaluating pledged-asset lending programs. Each pilot institution will provide feedback that refines control specifications and evidence requirements before broader release.

We are sharing this publicly because the compliance gap is an industry problem, not a proprietary advantage. Institutions that choose a different lending technology provider still need a compliance framework. If ACAF becomes the standard, the entire sector benefits from reduced examination friction, clearer regulatory expectations, and lower deployment risk. We would rather compete on technology within a well-defined compliance landscape than compete in a compliance vacuum where every institution is improvising and every enforcement action damages market confidence.

The bad actors will keep shipping no-KYC debit cards and putting JPEGs on blockchains. The regulated institutions that serve real people with real financial needs deserve better infrastructure. That is what we are building.

ACAF control specifications and domain documentation are in active development. Institutions interested in pilot participation or framework review can contact us directly. This article describes a compliance framework design, not financial or legal advice. Consult qualified legal counsel before deploying any pledged-asset lending program.